CVE-2017-16239

Description

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.

6.5

CVSS

Severity: Medium

CVSS 3.0 •

CVSS 2.0 •

EPSS 0.40%

Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory openstack.org

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/101950	vdb entry third party advisory
https://access.redhat.com/errata/RHSA-2018:0369	vendor advisory
https://access.redhat.com/errata/RHSA-2018:0241	vendor advisory
https://www.debian.org/security/2017/dsa-4056	vendor advisory
https://launchpad.net/bugs/1664931	issue tracking
https://security.openstack.org/ossa/OSSA-2017-005.html	vendor advisory
https://access.redhat.com/errata/RHSA-2018:0314	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2017-16239?: CVE-2017-16239 has been scored as a medium severity vulnerability.
How to fix CVE-2017-16239?: To fix CVE-2017-16239, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2017-16239 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2017-16239 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.